Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

A September 29, 2026 audit found that IRS controls did not adequately prevent or detect suspicious access to high-profile taxpayers’ records. The Treasury Inspector General for Tax Administration (TIGTA) identified 86 suspicious accesses involving 30 accounts and 52 IRS employees in a targeted review of system logs. Those entries were referred for investigation; they are not 86 proven violations.

What did the audit find?

TIGTA concluded that the IRS lacked adequate preventive controls and had not effectively identified suspicious access after it occurred. The review covered Integrated Data Retrieval System (IDRS) audit logs for calendar years 2022 through 2025, with records reviewed through November 2025. TIGTA searched a limited set of high-profile taxpayer names, including government officials, business leaders, and entertainers.

The suspicious activity had not been identified by the IRS before TIGTA found it. The inspector general referred the accesses to its Office of Investigations for further action. The audit does not report the results of those investigations, so it does not establish how many entries will ultimately be substantiated as policy violations or crimes.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The sample was targeted at selected high-profile accounts. It is not an estimate of how often IRS employees improperly access taxpayer records generally, nor does it establish that every VIP account or every employee was reviewed.

How could employees access the records?

IRS employees may need to look at taxpayer records to perform their assigned work, but access is limited to an official tax-administration purpose. TIGTA found that existing preventive controls focused mainly on accounts belonging to employees’ family members or close relations. It found no mechanism designed to prevent or systematically detect browsing of celebrity or public-official accounts.

The NAMES command codes

TIGTA identified a weakness involving the NAMEB and NAMEI command codes, together known as NAMES. An employee can use a taxpayer’s name and address to retrieve identifying information, including a taxpayer identification number. The report said these codes bypassed existing IRS monitoring methods and lacked systemic preventive or monitoring controls.

As an example, TIGTA cited a customer service representative who searched for a prominent business leader using a NAMES command code. The report recommended that the IRS study stronger controls, including limiting which employees can use the codes and monitoring their use for suspicious activity.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What does IRS policy prohibit?

The Internal Revenue Manual, effective April 21, 2026, defines unauthorized access, attempted access, or inspection of taxpayer records (UNAX) as willful conduct. IRS personnel may access taxpayer records only when required for assigned official duties and through official channels. The manual specifically prohibits browsing a celebrity’s or politician’s return or return information without authorization and a need to know.

A suspicious log entry is not, by itself, a final determination that an employee acted willfully or violated policy. The IRS UNAX program covers prevention, detection, investigation, adjudication, notification, and reporting. TIGTA investigates suspected incidents; substantiated cases may be referred to the Department of Justice and the IRS for prosecution or administrative action. IRS policy allows discipline without a criminal conviction, and unlawful inspection may carry civil remedies even when information was not disclosed to someone else.

What did TIGTA find about discipline?

In a separate part of the audit, TIGTA reviewed 53 employee cases involving access to taxpayer accounts without the taxpayer’s knowledge or consent during fiscal years 2023–2025. These cases are distinct from the targeted count of suspicious VIP-account accesses.

Outcome in the reviewed cases What TIGTA reported
Terminated 31 of the 53 employees were terminated.
Not terminated 22 received other discipline, ranging from suspension to reprimand.
Reasons cited in non-termination decisions In 13 of the 22 cases, the deciding official cited length of service and a first-time offense.

TIGTA said the outcomes were inconsistent with the IRS Manager’s Guide to Penalty Determinations and the agency’s stated zero-tolerance approach. These figures describe the cases TIGTA reviewed for fiscal years 2023–2025; they do not describe the eventual discipline, if any, in the VIP-account referrals.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Were affected taxpayers notified?

TIGTA found two notification failures. IRS procedures were not followed for 175 taxpayers, so they were not notified. Another 101 taxpayers were not notified because the employees responsible had resigned or retired before discipline was proposed; the IRS process tied notification to proposed discipline. TIGTA also found that notices were not always sent promptly and recommended a process that ensures every affected taxpayer is notified.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What changes did TIGTA recommend?

The report lists eight recommendations. According to its summary, IRS management agreed or partially agreed with seven. The recommendations include studying stronger preventive controls, improving monitoring of NAMES command-code activity, clarifying discipline guidance, ensuring all affected taxpayers receive notification, establishing executive oversight, and improving performance measures. The report summary does not establish that these changes have since been implemented.

How does this compare with earlier UNAX figures?

Earlier government figures describe a different period and a broader set of UNAX investigations, not the 2026 targeted review of high-profile accounts. The Government Accountability Office reported that, from fiscal years 2012 through 2021, there were 1,694 IRS investigations involving a UNAX issue and 27% were substantiated as violations. TIGTA and the IRS took an average combined 464 days to investigate and close UNAX cases during that period. These historical measures should not be treated as outcomes or rates for the suspicious accesses identified in 2026.

How is this different from the Charles Littlejohn case?

Charles Edward Littlejohn’s case involved unlawful disclosure of taxpayer information by a contractor, not the suspicious access referrals in TIGTA’s 2026 audit. The IRS said Littlejohn pleaded guilty and was sentenced to five years in prison in February 2024. TIGTA’s 2026 report states that he accessed more than 400,000 taxpayer accounts. That case illustrates why access and disclosure must be distinguished: the VIP-account audit’s suspicious log entries do not establish that taxpayer information was disclosed.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.